Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object (SUSE Rancher)
At a glance
- Source
- NVD
- EPSS
- EPSS 4.17 % · percentile 91 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- suse
- NVD status
- Modified
Description
A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issue affects: SUSE Rancher Rancher versions prior to 2.5.16; Rancher versions prior to 2.6.7.
Weaknesses (CWE)
- CWE-312 — Cleartext Storage of Sensitive Information
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | suse |
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | NVD · meissner@suse.de (Secondary) |
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-g7j7-h4q8-8w2f — Rancher API and cluster.management.cattle.io object vulnerable to plaintext storage and exposure of credentials
European references
- ENISA EUVD · EUVD-2022-6818
- GCVE · GCVE-0-2021-36782
Affected configurations (NVD CPE)
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*≥ 2.5.0 < 2.5.16cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*≥ 2.6.0 < 2.6.7
Affected products
| Product | Versions |
|---|---|
| SUSE · Rancher | affected Rancher < 2.5.16 |
| SUSE · Rancher | affected Rancher < 2.6.7 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |